DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:content-type
	:content-transfer-encoding; q=dns; s=default; b=BAIvy+FwlY60xKkZ
	+I7+ttI/txKjoc40gvDCczEpjn390N846OdC4lEEmQweI463Hq9hDGos+9B6douG
	I3nhpMFvPJJeL5ha8KQ4yeZW0kVvjDiBlGJWR+STwoDMJ73DrnPuyZjnP9D4Ua/8
	Qkg/cnin6WNYmXxZpBwSOy+Pacw=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
MIME-Version: 1.0
In-Reply-To: <CAJ1BO=UK-Pe8_4QkUb1g0m4ti94sqUwmC-4M90J3zYwCccn87g@mail.gmail.com>
References: <CAJ1BO=UK-Pe8_4QkUb1g0m4ti94sqUwmC-4M90J3zYwCccn87g AT mail DOT gmail DOT com>
Date: Thu, 26 Sep 2013 14:37:03 +0200
Message-ID: <CAJ1BO=XAwakF6upfotVWcNagmoDdSS7atXtJtaCz7o-YY9Z5ZA@mail.gmail.com>
Subject: Re: GSSAPI authentication and OpenSSH on Windows
From: =?ISO-8859-1?Q?Alf_H=E5kansson?= <alf DOT hakansson AT foxt DOT com>
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit

Hello Ghis,
That might work but the user will not be logged on to the windows
machine. I.E. sshd will not be able to get hold of a security token
with the AD users context.
Going for that solution will only authenticate the user but when the
user gets the shell it will not be in the right context.

I think one needs to replace Heimdal/MIT Kerberos with the Windows
SSPI interface.

/Alf


Hi Alf,

Seems we both are close to a solution, but I didn't do any progress on
this issue on my side.

Your statement regarding ktpass for the keytab generation confirms my
initial fears...

I searched a little more on this this morning and I stumble upon this:
 http://web.mit.edu/kerberos/krb5-devel/doc/admin/princ_dns.html.

Basically, it says that setting GSSAPIStrictAcceptorCheck to no in
sshd_config wil make sshd.exe use the first entry in the keytab,
regardless of the principal name.  So, theoretically, we could
generate a keytab containing any principal name at sshd.exe would use
this happily.

Unfortunately, it seems this configuration directive is not supported
by the offical OpenSSH release.  This article mentions a certain patch
that should do the trick:
http://www.gossamer-threads.com/lists/openssh/dev/44429...

The only thing left to do/try, is to get a hand on the OpenSSH
sources, on the patch and try to rebuild OpenSSH.

Anyone could help in doing this?  Just provinding pointers on howtos
would be great! ;o)

Thank you!

Ghis


On Wed, Sep 18, 2013 at 3:55 PM, Alf Håkansson <alf DOT hakansson AT foxt DOT com> wrote:
> Hello!
>
> I am trying to get Kerberos authentication to work with openssh on a
> Windows machine that is part of a windows domain.
> I have read all I could find on the internet about this issue but no
> one seems to have succeeded.
>
> OpenSSH is built with the Heimdal package.
>
> There is a post that pretty well describes all the steps to take to
> get it to work (but it does not)
> http://cygwin.org/ml/cygwin/2013-08/msg00386.html
> As I subscribed after that post I have no idea how to reply to it.
>
> The problem occurs when I am making the keytab file with help of ktpass.exe.
>  I need the principal HOST/myhost.whatever.com
> Thing is that the machine itself is already registered with that
> principal and as the Domain Controler only can have one entry for that
> principal the machine will be deregistered and you can no longer logon
> with a domain user to the console.
>
> So please if anyone has any experience in this topic let me know!
>
> /Alf

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple